Active Directory Basics

In this exercise, you will create two domains (and two domain controllers) - one using the Server Manager GUI, and one using PowerShell. You will then create users and groups in each domain using the Active Directory Users and Computers GUI and PowerShell.

You will begin by using the Server Manager to install Active Directory Domain Services on the Windows 2022 GUI server.

1. On the taskbar, click the Windows Start icon, then click the Server Manager icon to open the Windows Server Manager.
   
   Allow Server Manager time to load fully (~30 seconds).
   

   

2. In the Server Manager, click the Add Roles and Features link to open the Add Roles and Features Wizard.
   
3. On the Before You Begin page, click Next to continue.
   
4. On the Installation Type page, click Next to accept the default and continue.
   
5. On the Server Selection page, click Next to accept the default (your current server) and continue.
   

   

6. On the Server Roles page, click the Active Directory Domain Services checkbox.
   
   When prompted, click Add Features to include the Features required for the Active Directory Domain Services role.
   

   

7. On the Server Roles page, click Next to continue.
   
8. On the Features page, click Next to continue.
   
9. On the AD DS page, click Next to continue.
   
10. On the Confirm Installation Selections page, click Install to continue.
    
    Wait a few minutes for Active Directory Domain Services to be installed. When the installation is complete, you will see a note indicating that there are additional configuration tasks required to promote this server to a domain controller.
    
    In the next steps, you will complete those tasks and promote the Windows 2022 GUI server to a domain controller.
    

    

11. On the Installation Progress page, click Close to return to the Server Manager.
    
12. In the upper-right corner, click the Notifications menu, then click the Promote this server to a domain controller link to open the Active Directory Domain Services Configuration Wizard.
    

    

13. On the Deployment Configuration page, select the “Add a new forest" radio button, then type superfriends.local in the Root Domain Name field and click Next to continue.
    

    

14. On the Domain Controller Options page, type P@ssw0rd! In the Directory Services Restore Mode password fields, then click Next to continue.
    

    

    This password is used to restore or repair Active Directory if needed.
    
15. On the DNS Options page, ignore the delegation warning and click Next to continue.
    
16. On the Additional Options page, click Next to accept the auto-generated NetBIOS name (SUPERFRIENDS) and continue.
    
    Note: A NetBIOS name cannot be more than 15 characters. This is something to keep in mind when you create your domain name.
    
17. On the Paths page, note where the Active Directory database will be stored on the server, then click Next to continue.
    
18. On the Review Options page, review your selections, then click Next to continue.
    
    The Active Directory installer will now perform a prerequisite check to ensure that Active Directory Domain Services can be installed and this server can be promoted to a Domain Controller.
    
    There will be a number of warnings that can be ignored. You should see a green checkmark and a message stating, "All prerequisite checks passed successfully".
    

    

19. On the Prerequisites Check page, click Install to continue.
    
    Allow the Active Directory installer to complete its task. You will get disconnected after a few minutes. Wait 1-2 minutes, then reconnect. If the reconnect fails, allow another few minutes before retrying. A new Domain Controller can take up to 5 minutes to fully boot.
    
20. Once re-connected to the Windows Server 2022 GUI machine, right-click the Windows Start icon and select Run, then type dsa.msc and press Enter to launch the Active Directory Users and Computer (ADUC) tool.
    
    In the ADUC, you should see your new domain (superfriends.local). ADUC is one of the primary tools for managing Active Directory. You can use ADUC to create and manage organizational units (OU), users, and groups.
    

    

    We will return to ADUC soon, but first we will create a second domain on a second Domain Controller. This time we will do so using PowerShell.
    
21. From the Machines tab, connect to the Windows 2022 PowerShell machine.
    
22. On the taskbar, right-click the Windows Start icon and select Windows PowerShell (Admin) to open a new PowerShell window.
    
    When prompted, click Yes to continue.
    
23. At the PowerShell prompt, type the following command and press Enter to install Active Directory Domain Services.
    Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
    Wait for Active Directory Domain Services to be installed. You should see an Exit Code confirming Success.
    

    

    Note: There is a text file called Commands.txt on the desktop with all the PowerShell commands you will be asked to type. While you should try and type out these commands, it is easy to make a typo - especially with spacing. Feel free to copy and paste from the text file if you get stuck. To paste in PowerShell, right-click the PowerShell window's title bar, then select Edit > Paste.
    
24. At the PowerShell prompt, type the following and press Enter to create the new legionofdoom.local domain:
    Install-ADDSForest -DomainName "legionofdoom.local" -CreateDnsDelegation:$false -DatabasePath "C:\Windows\NTDS" -DomainMode "7" -DomainNetbiosName "LEGIONOFDOOM" -ForestMode "7" -InstallDns:$true -LogPath "C:\Windows\NTDS" -NoRebootOnCompletion:$False -SysvolPath "C:\Windows\SYSVOL" -Force:$true

    

25. When prompted for the DSRM password, type P@ssw0rd! and press Enter. You will need to do this twice.
    
    As you did for superfriends.local, wait for the Active Directory installer to complete its task. You will get disconnected after a few minutes. Wait 1-2 minutes and then reconnect. If the reconnect fails, allow another few minutes before retrying.
    
    Be sure you are back on the Windows 2022 PowerShell machine - not the GUI machine - before continuing.
    
26. Once reconnected to the Windows 2022 PowerShell machine, right-click the Windows Start icon and select Windows PowerShell (Admin) to re-open PowerShell.
    
27. At the PowerShell prompt, type Get-ADDomain and press Enter, then take note of the available details about the newly created legionofdoom.local domain. You will need these details to complete one of the questions on the Tasks tab.
    
    Next, let's return to the superfriends.local domain and start creating some domain objects.
    
28. From the Machines tab, connect to the Windows 2022 GUI machine.
    
29. In the ADUC window, expand superfriends.local.
    
    Take note of the built-in folders (called containers) the Active Directory Installer created.
    

    

    Note: These containers could be used to home all your users, groups, and computers. However, containers are limited because Group Policy cannot manage them. Windows administrators rely on Group Policy to help manage directory objects. Thus, even if you are not ready to use Group Policy, creating Organizational Units for your users and groups is better, allowing for future Group Policy management.
    
30. In the ADUC window, right-click the superfriends.local domain object in the navigation tree and select New > Organizational Unit from the context menu to open the New Object - Organizational Unit window.
    
31. In the New Object - Organizational Unit window, type Hall of Justice and click OK.
    
    In the ADUC window, you should see the new OU in the navigation tree.
    
    Note: It’s perfectly fine to use spaces when naming an OU.
    
    Tip: You can tell that “Hall of Justice” is an OU and not a container by the icon. Notice that “Hall of Justice” and “Domain Controllers” are both OUs.
    
32. In the ADUC window, right-click the Hall of Justice OU and select New > User from the context menu to open the New Object - User window.
    
33. In the New Object - User window, fill in the information below for Bruce Wayne, then click Next to continue.
    
    First Name: Bruce
    Last Name: Wayne
    User logon name: bruce.wayne
    

    

34. At the password prompt, set Bruce Wayne's password to P@ssw0rd! and uncheck the " User must change password at next logon" box, then click Next to continue.
    

    

35. Click Finish to create the Bruce Wayne User using the ADUC tool.
    
    Take note of the new Bruce Wayne user in the Hall of Justice OU.
    

    

    Next, we'll return to our other domain controller to add a new user to the legionofdoom.local domain using PowerShell (the preferred scripting language of supervillains).
    
36. From the Machines tab, connect to the Windows 2022 PowerShell machine.
    
37. At the PowerShell prompt, type New-ADOrganizationalUnit -Name "Hall of Doom" -Path "DC=legionofdoom,DC=local" and press Enter to create a new OU in the legionofdoom.local domain.
    
38. At the PowerShell prompt, type Get-ADOrganizationalUnit -Filter ' Name -like "*" ' | Format-table Name and press Enter to confirm your OU's creation.
    

    

    As you saw with the ADUC tool in the superfriends.local domain, you will see two OUs. In this case, you will see Domain Controllers and Hall of Doom.

    

39. At the PowerShell prompt, type the following and press Enter to create the Lex Luthor user in the Hall of Doom OU.
    New-ADUser -Name "Lex Luthor" -DisplayName "Lex Luthor" -GivenName "Lex" -Surname "Luthor" -SamAccountName "lex.luthor" -UserPrincipalName "lex.luthor@legionofdoom.local" -Path "OU=Hall of Doom,DC=legionofdoom,DC=local" -AccountPassword(Read-host -AsSecureString "Input Password") -Enabled:$true

    

    Note: You may wonder what fields in the New-ADUser PowerShell command map to the ADUC “New Object - User” form. The image below should help:

    

40. When prompted, enter P@ssw0rd! for Lex Luthor's login password.
    
41. At the PowerShell prompt, type Get-ADuser -Filter ' Name -like "Lex*" ' and press Enter to confirm the creation of Lex Luthor's user account.
    

    

42. On the taskbar, right-click the Windows Start icon and select Run, then type dsa.msc and press Enter to launch the Active Directory Users and Computer (ADUC) tool.
    
43. In the ADUC window, expand the legionofdoom.local domain object, then click Hall of Doom.
    
    You should see the new Lex Luthor user account.
    

    

44. In the ADUC window, right-click Lex Luthor and select Properties from the context menu to open the Lex Luthor Properties window.
    
    Take note of the General tab and the Account tab. Compare these to the General and Account Tab for Bruce Wayne in the open ADUC tool on the Windows 2022 GUI server.
    
    Note: You may have noticed the many tabs associated with each user account. Active Directory provides a lot of places to store information related to a user.
    
45. Close the Bruce Wayne and Lex Luthor Properties windows.
    
    Next, we will learn how to create groups. In Active Directory, groups can be used for communication (distribution groups) and permission (security groups). Distribution Groups are only used when Microsoft Exchange is added to a domain. Security Groups are the primary way to grant permissions to domain resources (like files and folders). There are three types of Security Groups: Universal, Global, and Domain Local.
    
    Universal Groups: Contains users and groups from any domain in a forest.
    Global Groups: Contains users and groups from the same domain.
    Domain Local: Used to grant access to domain objects.
    
    Because we have only a single domain in each of our two forests, there is no need to use Universal Groups. With only a single domain, Microsoft recommends the following best practice: AGDLP. AGDLP stands for "account, global, domain local, permission". That means user accounts are added to Global groups, which are added to Domain Local groups. The Domain Local groups are granted permissions to objects.
    
    Note: In a production environment, you will likely find that users are granted access to resources directly or that the Global groups are granted direct access to resources. Granting permission this way works, of course, but poor practices will lead to a tangled web of permissions that can be hard to manage.
    
    In the next steps, we will create a Global group in each domain and add our users to the group we create.
    
46. From the Machines tab, connect to the Windows 2022 GUI machine.
    
47. In the ADUC window, right-click the Hall of Justice OU and select New > Group to open the New Object - Group dialog box.
    
48. In the New Object - Group dialog box, enter the following information, then click OK.
    
    Group Name: Heroes
    Group scope: Global
    Group type: Security
    
    In the ADUC window, you will see a new Global security group in the Hall of Justice OU.
    

    

49. In the ADUC window, double-click the new Heroes group to open the Heroes - Properties window.
    
50. In the Heroes Properties window, click the Members tab, then click Add… to open the Select Users… window.
    
51. In the Select Users… window, type Bruce Wayne and click Check Names.
    
    Active Directory will search for Bruce Wayne and fill in his full user principal name. Click OK to complete adding Bruce Wayne to the Heroes Global group.
    

    

52. In the Heroes Properties window, verify that Bruce Wayne is now listed on the Members tab, then click OK to close the window.
    
    Now let's create a new Global group using evil PowerShell.
    
53. From the Machines tab, connect to the Windows 2022 PowerShell machine.
    
54. At the PowerShell prompt, type the following and press Enter to create the Villains Global group in the Hall of Doom OU.
    New-ADGroup -Name "Villains" -SamAccountName "Villains" -GroupCategory Security -GroupScope Global -DisplayName "Villains" -Path "OU=Hall of Doom,DC=legionofdoom,DC=local"
    
55. At the PowerShell prompt, type Get-ADGroup -Filter ' Name -like "Villains" ' and press Enter to confirm the new group creation.
    

    

56. At the PowerShell prompt, type Add-ADGroupMember -Identity "Villains" -Members lex.luthor and press Enter to add Lex Luthor to the Villains Global group.
    
57. At the PowerShell prompt, type Get-ADGroupMember -Identity "Villains" and press Enter to confirm that Lex Luthor is now a member of the Villains Global group.
    

    

58. In the ADUC window, open the Properties window for Villains and verify that Lex Luthor is a member.
    
    And that's it! You've now installed Active Directory Domain Services and created multiple OU's, Groups, and Users on two servers, using two different methods. Be sure to answer the questions on the Tasks tab if you haven't already, then proceed to the Challenge Exercise for additional practice.